The invention is a method of detecting malicious behavior of a network participant. Specific usage values observable at a network connectivity layer are defined. These usage values can be size of data transferred, quantity of data bursts, a quantity of ip address destinations, a network protocol being used, and/or a length of an encryption key. The invention measures the usage values for the network participant across multiple networks over a predetermined period of time and creates a statistical digital dossier representative of patterns of the measured usage values for the network participant. The invention monitors the behavior of the network participant by measuring current usage values. The current usage values are compared against the statistical digital dossier and, if a deviation beyond a predefined tolerance is detected, an alert signal is issued.
|
1. A method of detecting an anomaly in a network participant's usage of a network comprising the steps of:
defining a set of usage values observable at a network connectivity layer, the usage values selected from the group consisting of a size of data transferred, a quantity of data bursts, a quantity of ip address destinations, a type of network protocol being used, and a length of an encryption key;
measuring the usage values for the network participant across a plurality of networks over a predetermined period of time;
constructing a time series of the measured usage values to establish a statistical digital dossier representative of patterns of the measured usage values for the network participant across the plurality of networks;
capturing data traffic exchanged between the network participant and a sever;
identifying the participant's current data traffic by correlating the data traffic with the control signaling, authentication signaling, or ip address allocated by Dynamic Host Configuration protocol (DHCP);
measuring current usage values of the network participant's data traffic in real time, the current usage values selected from the group consisting of the size of data transferred, the quantity of data bursts, the quantity of ip address destinations, the type of network protocol being used, and the length of an encryption key;
comparing the current usage values against the usage values within the statistical digital dossier of the network participant; and
responsive to the current usage values deviating from the usage values within the statistical digital dossier beyond a predefined tolerance, issuing an alert signal.
12. A non-transitory computer-readable medium storing a program including instructions that, when executed by a processor, cause the processor to perform the steps comprising:
receiving a set of predefined usage values observable at a network connectivity layer, the usage values selected from the group consisting of a size of data transferred, a quantity of data bursts, a quantity of ip address destinations, a type of network protocol being used, and a length of an encryption key;
measuring the usage values for the network participant across a plurality of networks over a predetermined period of time;
constructing a time series of the measured usage values to establish a digital dossier representative of patterns of the measured usage values for the network participant across the plurality of networks;
obtaining captured data traffic exchanged between the network participant and a sever;
identifying the participant's current data traffic by correlating the data traffic with the control signaling, authentication signaling, or ip address allocated by Dynamic Host Configuration protocol (DHCP);
measuring current usage values of the network participant's data traffic in real time, the current usage values selected from the group consisting of the size of data transferred, the quantity of data bursts, the quantity of ip address destinations, the type of network protocol being used, and the length of an encryption key;
comparing the current usage values against the usage values within the statistical digital dossier of the network participant; and
responsive to the current usage values deviating from the usage values within the statistical digital dossier beyond a predefined tolerance, issuing an alert signal.
2. The method of
3. The method of
4. The method of
5. The method of
6. The method of
7. The method of
8. The method of
9. The method of
10. The method of
11. The method of
13. The non-transitory computer-readable medium of
14. The non-transitory computer-readable medium of
15. The non-transitory computer-readable medium of
16. The non-transitory computer-readable medium of
17. The non-transitory computer-readable medium of
18. The non-transitory computer-readable medium of
19. The non-transitory computer-readable medium of
20. The non-transitory computer-readable medium of
|
|||||||||||||||||||||||||||||||||||||||||
This non-provisional application claims priority to U.S. Provisional Patent Application No. 62/526,437 filed Jun. 29, 2017, entitled “Method for Computationally Detecting Anomalies of Digital Device Behavior on a Communications Network,” which is incorporated herein by reference.
This invention relates to Telecommunications. More specifically, it relates to a method of identifying potentially malicious behavior on a communications network.
Malicious behavior of communications network participants can be disruptive to the normal functionality of the network. Both human and machine network participants may become compromised and, as a result, may start exhibiting malicious behavior. While typical human-oriented authentication methods, such as the ones involving passwords, multi-factor passwords, face recognition, and biometric dossiers can ensure that the network participant is a human rather than a bot, these authentication methods do not detect or prevent unwanted behavior.
Additionally, it is possible that a human using/directing a given device is not exhibiting malicious behavior, but the device's application is infected with malicious software. Again, a human-oriented authentication/attestation will not prevent the unwanted behavior because the human will successfully pass the authentication challenge. Finally, it is possible that malicious behavior can only be attributed to a ‘group’ of participating devices/applications—while an individual device application is not violating an expectation. Again, in this case, human-oriented authentication will not stop or alert about the unwanted behavior.
Thus, what is needed is a method of establishing a model of a network participant's network usage and automatically comparing user's real-time usage values against the model to detect anomalies in network participant's behavior, which triggers an alert signal being automatically transmitted to a network administrator.
In an embodiment, the invention is a method of detecting malicious behavior of a network participant. A set of usage values observable at a network size of data transferred, quantity of data bursts, quantity of IP address destinations, a type of network protocol being used, and a length of an encryption key. A Data Processing Module measures the usage values for the network participant across a plurality of networks over a predetermined period of time. Based on the measured usage values, the Data Processing Module creates a statistical digital dossier representative of patterns of the parameters associated with the network participant's use of the network.
A Traffic Capturing Module captures data traffic exchanged between the network participant and the severs. The data traffic can be captured using a mirroring or reporting function of an existing network device, or via adding a network capturing device into the plurality of networks.
The Traffic Capturing Module makes the captured data traffic available to the Data Processing Module. The Data Processing Module identifying the participant's current data traffic by correlating the data traffic with the control signaling, authentication signaling, or IP address allocated by Dynamic Host Configuration Protocol (DHCP). After the network participant's data traffic is obtained, the Data Processing Module measures current usage values of the network participant's data traffic in substantially real team. Next, the Data Processing Module compares the current usage values against the usage values within the statistical digital dossier of the network participant. If the current usage values deviate from the usage values within the statistical digital dossier beyond a predefined tolerance, an alert signal is issued to the network administrator.
In an embodiment, time series similarity measures are used to compare the current usage values against the statistical digital dossier uses. Some examples of the time series similarity measures are Pearson's correlation, Goodman and Kruskal's gamma, and distance correlation. A data-frame arrival time may be used as a foundational time for the time series.
The network participant may be a device, a device and application, or a group of devices and applications under a common group identifier. The network participant may be identified by the device Media Access Control (MAC) address, subscriber identifier, user name, International Mobile Subscriber Identity (IMSI), or Mobile Station International Subscriber Directory Number (MSISDN). The networks on which network participant's usage values may be observed include wired and wireless networks, such as Code Division Multiple Access (CDMA), General Packet Radio Service (GPRS), Universal Mobile Telecommunications System (UMTS), Long-Term Evolution (LTE), 5G, Low Power Wide Area Networks (LPWAN), Wi-Fi, Broadband Internet, Asymmetric digital subscriber line (ADSL), and a combination thereof.
In an embodiment, a cipher suite is used to measure the length of the encryption key.
In an embodiment, the system has a self-updating capability: if the current usage values are within the predefined tolerance, the network participant's statistical digital dossier is updated based on the current usage values. The statistical digital dossier may be created using data available in every frame of data transmitted to and from the network participant.
For a fuller understanding of the invention, reference should be made to the following detailed disclosure, taken in connection with the accompanying drawings, in which:
The invention enables detection of malicious and/or unwanted behavior of human and machine network participants after they pass initial authentication.
In the embodiment depicted in
Traffic Capturing Module 20 identifies data traffic of network participant 12 by correlating the data traffic with the control signaling, authentication signaling, or IP address allocated by Dynamic Host Configuration Protocol (DHCP), filters out the traffic related to network participant 12, and calculates the usage values in real time or near-real time manner. The usage values include the size of data transferred, the quantity of data bursts, the number of IP address destinations, the network protocol being used; and the length of an encryption key; then reports the usage values to the Data Processing System.
As shown in
Based on current usage values that are collected from network participant 12 during a predefined period of time, Data Processing Module 16 further updates statistical digital dossier 18 representative of patterns of the measured usage values after a predefined period of time. Thus, the invention enables self-update capabilities of statistical digital dossier 18 without the need for human interaction.
The method of detecting suspect behavior according to the present invention is schematically illustrated in
In step 104, Data Processing Module 16 measures the usage values associated with network participant's 12 data traffic captured by Traffic Capturing Modules 20. In step 106, Data Processing Module 16 creates statistical digital dossier 18 of network participant's 12 typical connectivity usage pattern. Statistical digital dossier 18 is created by analyzing usage patterns of a given network participant 12 across at least one, but preferably, multiple operator networks 14. By using data traffic from multiple networks 14, the invention improves precision of statistical digital dossier 18. The invention leverages the fact that a given network participant 12 can often roam on more than one network 14 at different times and may different behaviors on different networks 12. The behavior of network participant 12 observed by connectivity enabler (e.g., network operator) can be digitally encoded using traffic data of network participant 12 across multiple networks 12.
In step 108, Data Processing Module 16 measures network participant's 12 current usage values based on the data traffic captured by Traffic Capturing Module 20. In step 110, a current digital dossier representative of network participant's 12 real-time usage values is created. In step 112, Data Processing Module 16 compares the current usage values against the statistical digital dossier 18. If the current usage values are not in line with network participant's 12 statistical digital dossier 18 beyond a predefined permissible threshold network participant 12 is considered to be “suspect.” In step 114, an alert signal is issued. The alert signal communicates to the system administrator the detected anomaly along with corresponding data context for subsequent analysis and resolution workflows.
The following example is used to illustrate an embodiment of the invention. For example, a Smart Car (a car that has multiple Devices that use mobile network)—i.e., network participant 12—would usually roam between different networks 14 depending on the car's geographical location. This means that the Smart Car would use multiple mobile networks 14 over time. The patterns of use exhibited by the Smart Car across the multiple networks 14 leads to creation of a multi-factor behavioral dossier 18 of a given device's usage. The ability to track the behavior of network participant 12 across multiple networks 14 enables creation of a more precise statistical digital dossier 18. Statistical digital dossier 18 represents similarity of a usage pattern across mobile network operators 18.
Once network participant's 12 statistical digital dossier 18 is established, it is possible to perform behavior attestation associated with network participant 12. If the real-time usage values fall outside of statistically-defined parameters of the statistical digital dossier 18, which is used as a reference of network participant's 12 ordinary network behavior, then the invention will detect the abnormality and issue an alert for subsequent analysis/resolution steps.
Statistical digital dossier 18 is built from data available in every frame of transmitted data. Statistical digital dossier 18 can include aggregated values as well as the details from which they were built. For mobile network operators, and IPX network operators (IPX network operator deal with roaming related mobile data, voice, messaging traffic), all the attributes of typical internet traffic are available, in addition to the home operator ID, the device ID, and the roaming (visiting) operator ID.
The invention constructs time series for details and aggregation-level data values that constitute Statistical digital dossier 18 of network participant 12 for networks 14. Data-frame arrival time is used as foundational time for the time series. Data frames contain volume, sequence and other important attributes. For example, to support the attribute of the feature vector x_5 (see below) a Cipher Suite can be used as it provides encryption key length and encryption cipher used, for encrypted traffic.
In an embodiment, the observation values the invention uses are all of the available fields in the corresponding traffic. Some examples of measurable usage values are depicted in
(x_1) Size of data transferred. 24 hours can be split in 1000 segments. The amount of data uploaded and downloaded by a given device per time segment is recorded. The observation is done over a predefined period—e.g., a month. The predefined time period is a particular dimension, which is by itself a time series matrix.
(x_2) Data bursts. Same methodology as x_1 above, but only bursts are recorded as observed value, rather than download/upload data size. Where burst is a number of KBs exceeding a preconfigured threshold.
(x_3) Number of IP address destinations. Note, normally it is best to categorize the destination IP addresses by source application, but in encrypted traffic pattern the source application is not known and, therefore, the destination IP address is used.
(x_4) Network protocol being used within a given session including the following:
(x_5) Estimated (or declared) length of encryption key. If the key length is smaller than usual, then then the invention can alert that encryption strength might have been reduced, even if all the other dimensions are the same.
Several time-series-similarity measures can be applied to measure real-time usage values with one or more of the observation values listed above that have been previously established across multiple networks 14 that network participant 12 used previously. There are a number of applicable time series similarity measures that can be used. These are called correlation coefficients. One such example is a scaled correlation that is a variant of Pearson's correlation in which the range of the data is restricted intentionally and in a controlled manner to reveal correlations between fast components in time series. Another example is Goodman and Kruskal's gamma. A third example is distance correlation.
Time series model is a good fit to implement the digital dossier of usage. The feature vector is defined, where every dimension is a time series itself. This enables the invention to use various statistics to measure the similarity between previous and current usage dossiers.
After the similarity of the current and previous dossiers is evaluated, the invention can issue an alert to designated users, and request an action. The alerting step can be implement programmatically via API or by other means that allow to request a decision/sentiment of a human operator.
Participant behavior attestation can also be time-based. For example, a first device having a first IP address can communicate with a second device having a second IP address using that digital dossier only during a designated time period.
Time interval is measured per network participant, per connectivity session.
Time series Session Level: is defined as consecutive, equally-spaced time intervals, assigned TimeTD, and the associated values of aggregated observations.
Time series Cross Session Level: is defined as consecutive, equally spaced time intervals, assigned timeID, and the associated aggregated values of observations within that time period.
Time series Cross Device Level: is defined same as Time Series Cross session level, only instead of organized within a device Id, these are organized within a group of devices (where the group ID is the ID).
The present invention may be embodied on various platforms. The following provides an antecedent basis for the information technology that may be utilized to enable the invention.
Embodiments of the present invention may be implemented in hardware, firmware, software, or any combination thereof. Embodiments of the present invention may also be implemented as instructions stored on a machine-readable medium, which may be read and executed by one or more processors. A machine-readable medium may include any mechanism for storing or transmitting information in a form readable by a machine (e.g., a computing device). For example, a machine-readable medium may include read only memory (ROM); random access memory (RAM); magnetic disk storage media; optical storage media; flash memory devices; electrical, optical, acoustical or other forms of propagated signals (e.g., carrier waves, infrared signals, digital signals, etc.), and others. Further, firmware, software, routines, instructions may be described herein as performing certain actions. However, it should be appreciated that such descriptions are merely for convenience and that such actions in fact result from computing devices, processors, controllers, or other devices executing the firmware, software, routines, instructions, etc.
The machine-readable medium may be, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples (a non-exhaustive list) of the computer readable storage medium would include the following: an electrical connection having one or more wires, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In the context of this document, a computer readable storage medium may be any non-transitory, tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device.
A machine-readable signal medium may include a propagated data signal with machine-readable program code embodied therein, for example, in baseband or as part of a carrier wave. Such a propagated signal may take any of a variety of forms, including, but not limited to, electro-magnetic, optical, or any suitable combination thereof. A machine-readable signal medium may be any machine-readable medium that is not a computer readable storage medium and that can communicate, propagate, or transport a program for use by or in connection with an instruction execution system, apparatus, or device. However, as indicated above, due to circuit statutory subject matter restrictions, claims to this invention as a software product are those embodied in a non-transitory software medium such as a computer hard drive, flash-RAM, optical disk or the like.
Program code embodied on a machine-readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wire-line, optical fiber cable, radio frequency, etc., or any suitable combination of the foregoing. Machine-readable program code for carrying out operations for aspects of the present invention may be written in any combination of one or more programming languages, including an object oriented programming language such as Java, C#, C++, Visual Basic or the like and conventional procedural programming languages, such as the “C” programming language or similar programming languages.
Aspects of the present invention are described below with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems) and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and/or block diagrams, and combinations of blocks in the flowchart illustrations and/or block diagrams, can be implemented by machine-readable program instructions.
Alert signal—a data packet or an electric signal transmitted to alert a network administrator of an anomaly detected in a network participant's usage of a network.
Current usage values—values of substantially real-time parameters associated with a network participant's usage of a network.
Data traffic—data packets traversing a network at a given point in time.
Network connectivity layer—a network layer responsible for packet forwarding and routing.
Network participant—an application, device, or a combination thereof that transmits or receives data packets via a network.
Server—a computer program or device that provides services to a network participant.
Statistical digital dossier-a model of network participant's ordinary usage of a network based on user's historical use of a network.
Usage values—parameters associated with a network participant's use of a network.
The advantages set forth above, and those made apparent from the foregoing disclosure, are efficiently attained. Since certain changes may be made in the above construction without departing from the scope of the invention, it is intended that all matters contained in the foregoing disclosure or shown in the accompanying drawings shall be interpreted as illustrative and not in a limiting sense.
Example of an HTTS (TLS-encrypted) packet. The encrypted traffic has significantly fewer details than non-encrypted traffic. APPENDICES A-B show observable usage values (emphasized in bold) that are used for creating the digital dossier of the network participant's behavior derived from encrypted traffic.
This is an example of a frame #5 within a packet that establishes a new session or continuous an existing one. A number of technologies can be used to correlate subsequent traffic to the initial traffic because many traffic attributes are declared on initial handshake, and then not repeated during a connection session.
Cipher Suit shows the type of cipher and the key length used. This field corresponds to X_5 attribute of the DUFP-V vector.
Example of an HTTS (TLS-encrypted) packet:
Example of a frame in which data is encrypted using QUIC protocol:
Xu, Huiyue, Papayan, Vladislav
| Patent | Priority | Assignee | Title |
| Patent | Priority | Assignee | Title |
| 9672503, | May 21 2013 | Amazon Technologies, Inc | Bandwidth metering in large-scale networks |
| 20140074614, | |||
| 20150212869, | |||
| 20150213631, | |||
| 20150324582, | |||
| 20150339477, | |||
| 20160028770, | |||
| 20160036722, | |||
| 20160072834, | |||
| 20160261465, | |||
| 20170126718, | |||
| 20170201850, | |||
| 20170302679, | |||
| 20170303180, | |||
| 20170310693, | |||
| 20170310703, | |||
| 20170324759, | |||
| 20170325113, | |||
| 20180019931, | |||
| 20180027004, | |||
| 20180314965, |
| Executed on | Assignor | Assignee | Conveyance | Frame | Reel | Doc |
| Jun 29 2018 | Syniverse Technologies, LLC | (assignment on the face of the patent) | / | |||
| Jul 03 2018 | XU, HUIYUE | Syniverse Technologies, LLC | ASSIGNMENT OF ASSIGNORS INTEREST SEE DOCUMENT FOR DETAILS | 046367 | /0036 | |
| Jul 09 2018 | PAPAYAN, VLADISLAV | Syniverse Technologies, LLC | ASSIGNMENT OF ASSIGNORS INTEREST SEE DOCUMENT FOR DETAILS | 046367 | /0036 | |
| May 13 2022 | Syniverse Technologies, LLC | BARCLAYS BANK PLC, AS COLLATERAL AGENT | NOTICE AND CONFIRMATION OF GRANT OF SECURITY INTEREST IN PATENTS | 060072 | /0598 |
| Date | Maintenance Fee Events |
| Jun 29 2018 | BIG: Entity status set to Undiscounted (note the period is included in the code). |
| Aug 31 2022 | M1551: Payment of Maintenance Fee, 4th Year, Large Entity. |
| Date | Maintenance Schedule |
| Mar 05 2022 | 4 years fee payment window open |
| Sep 05 2022 | 6 months grace period start (w surcharge) |
| Mar 05 2023 | patent expiry (for year 4) |
| Mar 05 2025 | 2 years to revive unintentionally abandoned end. (for year 4) |
| Mar 05 2026 | 8 years fee payment window open |
| Sep 05 2026 | 6 months grace period start (w surcharge) |
| Mar 05 2027 | patent expiry (for year 8) |
| Mar 05 2029 | 2 years to revive unintentionally abandoned end. (for year 8) |
| Mar 05 2030 | 12 years fee payment window open |
| Sep 05 2030 | 6 months grace period start (w surcharge) |
| Mar 05 2031 | patent expiry (for year 12) |
| Mar 05 2033 | 2 years to revive unintentionally abandoned end. (for year 12) |